IAM Password Policies Rule

IAM Password Policy Configuration for NIST Cybersecurity Framework (CSF) v1

Description:

Troubleshooting Steps (if applicable):

2. 1.
   Inspect the existing IAM password policy settings to identify any deviations from the NIST CSF v1 guidelines.
4. 2.
   Check whether users are adhering to the password requirements specified in the policy.
6. 3.
   Verify if any users are experiencing difficulties or errors when attempting to set their passwords.

Necessary Codes (if applicable):

Step-by-Step Guide for Remediation:

1. Accessing the IAM Console:

2. 1.
   Open a web browser and navigate to the AWS Management Console.
4. 2.
   Sign in with your AWS administrator credentials.
6. 3.
   From the AWS Management Console, search for and select "IAM" to access the IAM console.

2. Updating the IAM Password Policy:

2. 1.
   In the IAM console, click on "Account settings" in the navigation pane on the left.
4. 2.
   Under the "Password policy" section, click on the "Edit" button.

3. Setting the Password Policy Requirements:

2. 1.
   Specify the minimum password length by entering a value greater than or equal to 12.
4. 2.
   Check the box next to "Require at least one uppercase letter" to enforce the inclusion of at least one uppercase letter.
6. 3.
   Check the box next to "Require at least one lowercase letter" to enforce the inclusion of at least one lowercase letter.
8. 4.
   Check the box next to "Require at least one number" to enforce the inclusion of at least one numeric digit.
10. 5.
    Check the box next to "Require at least one non-alphanumeric character" to enforce the inclusion of at least one special character such as !@#$%^&*()_+{}|:<>?`-=[];',./.
12. 6.
    Specify the number of days before users are required to change their passwords by entering a value (e.g., 90 days).
14. 7.
    Check the box next to "Prevent password reuse" to disallow the reuse of previously used passwords.
16. 8.
    Optionally, enable "Enable password expiration" to enforce a maximum password age.
18. 9.
    Configure the remaining password policy settings based on the organization's requirements or NIST CSF guidelines.
20. 10.
    Click on the "Apply password policy" button to save the changes.

4. Verifying Password Policy Enforcement:

2. 1.
   Inform users about the updated password policy and instruct them to comply with the new requirements when setting or changing their passwords.
4. 2.
   Ensure that all new users adhere to the updated policy during account creation.
6. 3.
   Monitor user password changes and ensure they align with the password policy configuration by periodically reviewing relevant IAM logs and reports.